Computer security is an ever-evolving arms race between malicious actors on the one hand, and computer security firms and users on the other hand. One useful tool on the security side of this race is the “trusted execution environment” (TEE). A TEE is a combination of hardware, software, and firmware that provides an environment for executing signed and verified binaries or other executable objects. A TEE may include a processor with suitable extension instructions, such as the Intel® secure guard extension (SGX) instructions, a security coprocessor, appropriate firmware and drivers, and/or a special memory “enclave.” An enclave includes a special memory page or partition that can only be accessed and referenced via special TEE instructions. In particular, a program may write to or read from memory locations within the enclave, or execute instructions within the enclave, only by way of special instructions like Intel® SGX instructions. Any attempt to enter the enclave with other (nonsecure) instructions may result in an error such as a page fault.
In one example, a TEE is configured to execute only objects that are verified and signed, such as by a certificate authority. This helps to ensure that malware and other malicious objects are not executed within the TEE. In some examples, the TEE is given exclusive access to certain sensitive or important resources, such as important operating system files, sensitive data, or other protected resources. An enclave may be used to isolate trusted code, operating on confidential data, from the rest of a computing device, which may run untrusted code.